In the Claims 

1. (Cancelled) 

2. (Currently amended) The method of claim 4-3, further comprising: 

receiving an E-mail having the electronic document as an attachment; 
inspecting, as part of said scanning the electronic document, message text in the 
E-mail for viruses. 

3. (Currently amended) The-Ajnethod of claim 1, furth e r for scanning data comprising: 

receiving an electronic document; 

determining the electronic document is an archive file; 

a pplying risk-assessment heuristics to the electronic document to determine a risk 
factor for scanning the electronic document; 

assigning a scanning priority to the electronic document based at least in part on 
the risk factor, said scanning priorities including low scanning priority, normal scanning 
priority, and discard without scanning; 

selecting a scanning thread, from plural scanning threads having associated thread 
execution priorities, having an execution priority at least as high as said assigned 
scanning priority; and 

assigning performance of saki scanning the electronic document to said selected 
scanning thread ; and 

scanning the electronic document according to the scanning priority . 

4. (Original) The method of claim 3, further comprising: 

disposing the method within a multi-processor computing device; 

designating a first processor to process at least low scanning priority threads; and 

assigning said selected scanning thread to the first processor. 

5. (Currently amended) The method of claim 4-3, wherein risk-assessment comprises: 

determining if the electronic document is an archive containing files; and 
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if so, then a s e lect e d selecting for execution at least one of determining if the 
archive contains a sub-archive, determining if an aggregate de-archived size for said files 
exceeds a first threshold, determining if a file count of said files exceeds a second 
threshold, epand determining if a file-type count of said files exceeds a third threshold. 

6. (Original) The method of claim 5, wherein the first threshold is 10 megabytes, the 
second threshold is 50 files, and the third threshold is 10 file types. 

7. (Currently amended) The method of claim 4-3, further comprising: 

determining if electronic document is an archive containing files; 
if so, then determining if an aggregate de-archived size for said files exceeds a 
first threshold; 

if so, then determining if the aggregate de-archived size exceeds a disk space 
threshold; and 

if so, then setting the scanning priority of the electronic document to low scanning 
priority. 

8. (Currently amended) The method of claim 4-3, further comprising: 

determining if electronic document is an archive containing files; 
if so, then determining if an aggregate de-archived size for said files exceeds a 
first threshold; 

if so, then determining if a volatile memory requirement for scanning the archive 
exceeds a memory requirement threshold; and 

if so, then setting the scanning priority of the electronic document to low scanning 
priority. 

9. (Currently amended) The method of claim 4-3, further comprising: 

first determining if the electronic document is an archive containing files; 
second determining if at least one file of the archive is a sub-archive; 
third determining if an aggregate de-archived size for the archive exceeds a disk 
space threshold; 
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fourth determining if a file count for the archive of said files exceeds a file count 
threshold; and 

if each of said first, second, third and fourth determining evaluate true, then 
setting the scanning priority of the electronic document to discard without scanning. 

10. (Currently amended) The method of claim 4-3, in which the electronic document 
either is an archive, or contains the archive, the method further comprising: 

determining the archive contains at least one sub-archive therein; 
determining if the archive contains a large number of files; and 
determining if an un-archived size for the archive exceeds a predetermined size 
limit; and 

assigning the scanning priority to be discard without scanning if the archive 
contains a large number of files, and the un-archived size for the archive exceeds the 
predetermined size limit. 

1 1 . (Original) The method of claim 10, wherein if the un-archived size for the archive 
does not exceed the predetermined size limit, or the archive does not contain the large 
number of files, the method further comprising: 

assigning the scanning priority to be low scanning priority. 

12. (Currently amended) The method of claim 4-3, in which the electronic document 
either is an archive, or contains the archive, the method further comprising: 

determining if an un-archived size for the archive exceeds a size limit; 

determining if a memory requirement for performing said scanning the electronic 
document exceeds a memory limit; and 

assigning the scanning priority to be discard without scanning if the un-archived 
size for the archive exceeds the size limit, and the memory requirement for performing 
said scanning the electronic document exceeds the memory limit. 
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13. (Original) The method of claim 12, wherein if the memory requirement for 
performing said scanning the electronic document does not exceed the memory limit, the 
method further comprising: 

assigning the scanning priority to be low scanning priority. 

14. (Cancelled) 

15. (Currently amended) The medium of claim 1[[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 2. 

16. (Currently amended) An article of manufacture comprising a readable T he-medium 
of claim 1 4 , said having programming instructions encoded thereon, which when executed 
by a processor, are capable of directing including furth e r instructions to dir e ct the 
processor to perform the operations of claim 3. 

17. (Original) The medium of claim 16, said programming instructions including further 
instructions to direct the processor to perform the operations of claim 4. 

18. (Currently amended) The medium of claim 1 [[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 5. 

19. (Original) The medium of claim 18, said programming instructions including further 
instructions to direct the processor to perform the operations of claim 6. 

20. (Currently amended) The medium of claim 1[[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 7. 

21. (Currently amended) The medium of claim 1[[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 8. 
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22. (Currently amended) The medium of claim 1[[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 9. 

23. (Currently amended) The medium of claim 1[[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 
10. 

24. (Original) The medium of claim 23, said programming instructions including further 
instructions to direct the processor to perform the operations of claim 1 1 . 

25. (Currently amended) The medium of claim 1[[4]]6, said programming instructions 
including further instructions to direct the processor to perform the operations of claim 
12. 

26. (Original) The medium of claim 25, said programming instructions including further 
instructions to direct the processor to perform the operations of claim 13. 

27. (New) An apparatus comprising: 

means for receiving an electronic document; 

means for determining the electronic document is an archive file; 

means for applying risk-assessment heuristics to the electronic document to 
determine a risk factor for scanning the electronic document; 

means for assigning a scanning priority to the electronic document based at least 
in part on the risk factor, said scanning priorities including low scanning priority, normal 
scanning priority, and discard without scanning; 

means for selecting a scanning thread, from plural scanning threads having 
associated thread execution priorities, having an execution priority at least as high as said 
assigned scanning priority; 

means for assigning performance of scanning the electronic document to said 
selected scanning thread; and 

means for scanning the electronic document according to the scanning priority. 
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28. (New) The apparatus of claim 27 further comprising: 

means for designating a first processor to process at least low scanning priority 
threads within a multi-processor computing device; and 

means for assigning said selected scanning thread to the first processor. 

29. (New) The apparatus of claim 27, wherein risk-assessment comprises: 

means for determining if the electronic document is an archive containing files; 

and 

if so, selecting for operation at least one of means for determining if the archive 
contains a sub-archive, means for determining if an aggregate de-archived size for said 
files exceeds a first threshold, means for determining if a file count of said files exceeds a 
second threshold, and means for determining if a file-type count of said files exceeds a 
third threshold. 

30. (New) The apparatus of claim 27, wherein the electronic document either is an 
archive, or contains the archive, and further comprising: 

means for determining the archive contains at least one sub-archive therein; 

means for determining if the archive contains a large number of files; 

means for determining if an un-archived size for the archive exceeds a 
predetermined size limit; and 

means for assigning the scanning priority to be discard without scanning if the 
archive contains a large number of files, and the un-archived size for the archive exceeds 
the predetermined size limit. 
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